Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linuxinterfaceforon access scanning

tvrtko.ursulin
2008-08-13T13:52:18Z

Pavel Machek wrote on 13/08/2008 13:56:38:

Big snip since I am really only curious about libmalware.so.

> Plus, proposed solution already has three unacceptable holes:
>
> 1) it only catches known signatures
> 2) write vs. read race mentioned above

Discussions about perfect, better or no security are in danger of becoming
boring.

> 3) mmap problem
>
> . Making sure all apps use libmalware.so is trivial compared to
> solving 3).

You haven't answered what exactly is this libmalware.so, since you are the
only one mentioning it? It would be interesting to learn how it solves the
mmap problem, provides perfect security so it is acceptable, handles the
kernel NFS server serving malicious files, caters for applications which
do not use it, is better (more secure) than the kernel solution, provides
reasonalbe performance and is easier to maintain for the community? To
list only some of the requirements which have been mentioned so far.

--
Tvrtko A. Ursulin
Senior Software Engineer, Sophos

"Views and opinions expressed in this email are strictly those of the
author.
The contents has not been reviewed or approved by Sophos."

Sophos Plc, The Pentagon, Abingdon Science Park, Abingdon,
OX14 3YP, United Kingdom.

Company Reg No 2096520. VAT Reg No GB 348 3873 20.